GRE Tunnel Overhead Calculator for MTU, MSS, and Efficiency

Missing byte tunnel failure feel personal. Your policies are lined up right, your routing is correct, yet data just won’t flow. It waits in buffer or forces unwanted packet fragmentation. That’s not romantic, nor does it perform. Goodbye Generic Routing Encapsulation.

GRE is a simple concept: add a thin header to wrap around Layer 3 packets. In reality, the header gets fat quick. Plug your underlay into calculator. It’ll do the math for you, so you don’t have to guess if your route can absorbs those additional bytes. It’s just some basic math that throws off veteran engineers.

Why GRE Tunnels Fail Because of Packet Size

Take your physical interface with its default MTU of fifteen-hundred bytes. Then you remove the outer IP header. Immediately you lose twenty bytes if you’re running over IPv4. If you happen to be nested inside an IPv6 underlay then you loses forty bytes instantly. But you haven’t even begun to touch the GRE header! The bare minimum GRE header add another four bytes for flags and protocol type. That’s a large total of twenty-four to forty-four bytes lost to headroom before you’ve even sent any useful payload.

And this is where folks go wrong. They set up their tunnel and think their MTU hasn’t changed from fifteen hundred. And then they ask why huge packets is dropping silently on their ingress interface.

Throw in optional fields and it gets a lot tighter. In many of these hub-and-spoke designs, you have to send a unique value like the GRE key field. This differentiates one tunnel from another between the same pair of IP addresses. That’s an additional four bytes. Want sequence numbers? Add another four. Need checksums? None of these are free; each takes away from your overall maximum transmission unit.

As you can see on the reference table, a keyed IPv4 tunnel drop the inner limit down to just 1,472 bytes. Seems small, but remember: TCP segments themselves has their own headers that also want space. Which brings us to the Maximum Segment Size clamp. Instruct your edge devices to reduce the size of the TCP window. Wrap it all up with a TCP header, an IPv4 header, and a GRE header. This must not exceeds the physical MTU. If you don’t clamp the MSS, your hosts will send out packets that are fifteen-hundred bytes long. These arrive at the tunnel interface which attempts to wrap them in a GRE header and ship them off. But it’s too big; it exceeds fifteen hundred, and it drops/fragments the thing. Fragments is bad for throughput. Worse, they’re bad if you’re using an encrypted tunnel. You cannot even fragment these things.

What’s the magic MSS? That depends on exactly how much stuff sits on top of your payload. A simple IPv4 GRE tunnel should of use 1,436 as a safe target. Stick IPsec ESP encryption on there and the number get smaller still: IPsec has headers of its own to add.

There’s also efficiency in sending lots of packets: Four-bytes doesn’t sound like much when you’re sending millions of packets per second. But that overhead consumes real CPU cycles and bandwidth at line rate. The fixed part of the header is a bigger percentage of the frame, which hurts small packets more than big ones. And it will severely impact the effective throughput if your application produces lots of small flows. Per-packet overhead, as well as MTU limits, must be considered for planning. This packet-rate cost is estimated by the tool to help you determine whether the hardware can handle the tax before deployment.

And lastly, think about all the other details of underlay that don’t play in the IP stack. Each additional VLAN tag tacks on an additional four bytes. Each MPLS label adds another four. Every PPPoE packet add eight. All this impacts the size of the actual frame going over the wire. And then there’s the whole tunneling/PPP/Q-in-Q tagging thing, which eats away at the remaining space even more.

Your payload sits on top of a growing stack of headers that starts with the Ethernet frame and goes all the way back to your payload. It’s not so much about getting connected as it is getting connected efficienty. Proper alignment of MTU and MSS clamp settings with what’s actualy happening out on the wire helps prevent those silent failures. It is a little thing, but it counts.